SecureAFL: Secure Asynchronous Federated Learning

SecureAFL: Robustness in Asynchronous Federated Learning

Motivation and Problem Statement

Existing Federated Learning (FL) paradigms, especially those based on synchronous aggregation, are limited by the straggler problem—global model updates are delayed by the slowest clients, reducing scalability and efficiency. Asynchronous FL, where the server immediately integrates client updates, addresses system bottlenecks and is essential for real-world deployments with heterogeneous compute and network resources. However, asynchrony introduces unique vulnerabilities to poisoning attacks due to staleness, uneven client participation, and the inability to use batch-based robust aggregation strategies.

Poisoning in federated systems manifests through untargeted attacks (e.g., label flipping, Gaussian noise) that degrade model utility, or targeted attacks (e.g., various backdoor vectors) that aim for covert, conditional model manipulation. Most existing Byzantine-robust aggregation schemes are synchronous-centric, leveraging the statistical properties of simultaneous client updates, and do not transfer to the asynchronous regime due to missing or temporally distributed client contributions. Prior robust asynchronous FL solutions either fail under strong adversarial presence, require trusted reference datasets (often unrealistic), or add excessive cryptographic/computational complexity.

SecureAFL is proposed to systematically strengthen asynchronous FL against these multifaceted threats, with emphasis on practical robustness without unrealistic trust assumptions.

Architecture: Filtering, Estimation, and Aggregation

Update Filtering via Lipschitz Smoothness

A strict percentile-based filtering mechanism is constructed, leveraging the empirical Lipschitz continuity of local model update sequences from each client. The server tracks historical updates and the corresponding global model state for each client. Upon receipt of an update, a Lipschitz factor—quantifying the change in client update relative to change in global model—is computed and compared to historical behavior. Updates exceeding the designated percentile threshold are considered anomalous and discarded, sharply bounding the influence of abrupt (potentially adversarial) shifts.

This mechanism is adaptive to benign client heterogeneity and does not rely on any shared or reference dataset, which is crucial for genuinely heterogeneous (non-IID) FL deployments.

Estimation of Missing Updates

Since asynchronous FL implies that, at any given aggregation, only a subset of clients has provided fresh updates, SecureAFL employs historically informed estimation for the missing clients. Updates are estimated using L-BFGS-based quasi-Newton approximations, which exploit stored model differences and past client gradients to project the likely current update a missing client would contribute, given their behavioral history. This ensures balanced participation in aggregation and compensates for stragglers without penalizing accuracy or robustness.

Byzantine-Robust Aggregation

Aggregation is performed using coordinate-wise median, which confers robust tolerance under bounded Byzantine presence. If the received update passes the filtering criterion, it is used alongside the estimated updates in the aggregation; otherwise, aggregation occurs solely over the estimated values, minimizing adversarial influence. The aggregation method is chosen for its established breakdown point and minimal requirements regarding batch synchrony.

Initialization and Clipping

At initial rounds, when insufficient historical data exists for filtering or approximation, SecureAFL applies $\ell_2$-norm update clipping to ensure bounded influence, which is standard for stabilizing gradient-based distributed training in non-convex and adversarial environments.

Theoretical Properties

SecureAFL is proven to converge under standard non-convex settings with bounded staleness, strictly majority-benign assumption, and bounded estimation/tracking error, even with adversarial (Byzantine) participants. Robustness is quantified via a composite bound reflecting inter-client heterogeneity, aggregation noise, estimation accuracy of missing updates, and asynchrony-induced staleness. The main result guarantees convergence of the global model to a stationary point of the benign portion of the global objective, with statistical efficiency scaling with the proportion of benign clients and buffer/evaluation parameters.

The requirement that the aggregate set at each round contains a strict benign majority ($b < (n-1)/2$) is aligned with the theoretical limitations of median-based robust aggregation.

Experimental Validation

SecureAFL was subjected to extensive empirical validation on canonical and real-world datasets (Fashion-MNIST, CIFAR-10/100, Tiny-ImageNet, Udacity). Ten distinct attack types—including state-of-the-art untargeted, backdoor, and adaptive attacks—were conducted, and comparisons were made against seven recent asynchronous FL defenses.

Key observations include:

• Baseline performance parity: In non-adversarial situations, SecureAFL closely matches vanilla AsyncSGD in test error and RMSE, indicating no undue penalty from robust mechanisms in benign conditions.
• Resilience to untargeted and targeted attacks: Under strong poisoning, SecureAFL held TER and ASR near-baseline levels (e.g., testing error $\leq 0.3$ on CIFAR-10 under Gaussian attacks versus $\geq 0.8$ for AsyncSGD). For adaptive and backdoor attacks, SecureAFL reduced ASR to $\leq 0.1$ while keeping TER stable, even with up to 40% adversarial participation.
• Robustness to asynchrony and heterogeneity: Performance remains consistent regardless of delay maxima, number of clients, or degree of Non-IID partitioning. SecureAFL outperforms all batch or reference-dataset-dependent methods in settings with severe asynchrony or high data heterogeneity (where similarity-based or batch-statistical checks fail).
• Computational efficiency: Overhead is modest ($O(ned)$ per round), dominated by buffer size $e$, and scales linearly with system size and model dimension. No cryptographic primitives or trusted reference sets are required.
• Ablation studies: SecureAFL's completeness is verified—removal of filtering, estimation, or robust aggregation mechanisms results in significant vulnerability.

Limitations and Privacy Considerations

SecureAFL introduces, by necessity, an estimation of missing client updates based on their historical behavior. This process could increase the inference capacity of an honest-but-curious server regarding per-client optimization trajectories, although it does not require or expose raw data, labels, or reference examples. This risk is mitigable via standard privacy-preserving add-ons (clipping, noise injection, secure aggregation). Inference exposure remains internal to the server and is never communicated to other clients or external adversaries.

Server-side storage and computation are increased relative to vanilla async FL, but with bounded buffer sizes and practical implementation, the overhead is not prohibitive for modern centralized servers.

Implications and Future Directions

SecureAFL closes key robustness gaps for asynchronous FL, enabling secure, scalable operation in the presence of realistic, sophisticated poisoning threats. Its design eliminates reliance on trusted data or unrealistic synchrony, making it deployable in realistic distributed systems and edge scenarios. The empirical tolerances to client heterogeneity and asynchrony position it as a practical standard for production FL.

Future work should systematically investigate:

• Tightening convergence and robustness guarantees under arbitrary adversarial distributions, possibly relaxing benign-majority conditions.
• Layering privacy-preserving mechanisms atop SecureAFL’s estimation pipeline, achieving formal privacy-utility-robustness tradeoffs.
• Extending the framework to include multi-model or multi-task learning paradigms and exploring its behavior under cross-silo/cross-platform architectures.
• Hardware-aware adaptations to further minimize server-side resource requirements.

Conclusion

SecureAFL represents a comprehensive and practically viable defense for asynchronous federated learning. It synthesizes adaptive anomaly filtering, historical estimation for incomplete client information, and provable Byzantine-robust aggregation to secure aggregation pipelines—without requiring trusted reference data or cryptographic infrastructure. Experimental results strongly support its deployment for robust, real-world federated learning in adversarial and asynchrony-dominated regimes.